Using MaxSAT to Correct Errors in AES
Key Schedule Images
Xiaojuan Liao, Miyuki Koshimura, Hiroshi Fujita, Ryuzo Hasegawa
Hasegawa-Fujita Laboratory
Kyushu University
The 3rd CSPSAT2 Meeting
1
2013-7-26
Outline
 Cold Boot Attack
 Advanced Encryption Standard (AES)
 Recover AES key Schedule
- Using SAT solvers
- Using MaxSAT solvers
- Comparison
 Experiment
 Conclusion
2
2013-7-26
Cold Boot Attack (1/2)
 DRAM:
- Dynamic Random Access Memory
 DRAM cell:
- a capacitor that is either 0 or 1
- 0: ground state
- 1: charged state
 DRAM remanence:
- DRAM retains its contents for a period (seconds) after power is
lost
- As time goes on, data may decay and eventually disappear
 Cold boot attack:
- Exploit DRAM remanence to access sensitive data (e.g.,
encryption keys)
3
2013-7-26
A Scenario of Cold Boot Attack
Use secret key to
complete an
online transaction
Get the correct
secret key!
leave
secret key attacker
in memory comes
Public computer room
4
Remove the
memory and
retrieve the
contents
Get the decayed
key. How to recover?
2013-7-26
Cold Boot Attack (2/2)
 Decay patterns 1
- Decay aggravates as time goes on
- Most bits decay to ground states (1→0)
- Only a small fraction (0.1%) flips to charged states
(0→1)
 This work
- Recover AES keys from decayed bits
1
5
J. Alex Halderman et al., Lest We Remember: Cold Boot Attacks on Encryption Keys. USENIX08.
2013-7-26
Outline
 Cold Boot Attack
 Advanced Encryption Standard (AES)
 Recover AES key Schedule
- Using SAT solvers
- Using MaxSAT solvers
- Comparison
 Experiment
 Conclusion
6
2013-7-26
Advanced Encryption Standard(AES)
 What is AES
- A specification for the encryption of electronic data
established by the U.S. NIST 1
- Adopted by the U.S. government and used worldwide
 AES key 2
- Initial key length: 128 bits (options:192 bits, 256 bits)
- AES-128 key schedule:
128-bit
initial key
0th round key
7
1
128-bit
round key
128-bit
round key
…
128-bit
round key
10 rounds
NIST: National Institute of Standards and Technology
2 Federal Information Processing, Announcing the ADVANCED ENCRYPTION STANDARD (AES), 2001.
2013-7-26
Example of Key Schedule
Original key schedule
Decayed key schedule
reverse flipping error
8
Goal: correct errors in the decayed key schedule
2013-7-26
Key Expansion Algorithm
Given the 128-bit initial key, the following equations characterize bitrelations among the bits in the last 10 round keys:
(r-1)th round
key bit
AES-128 key expansion algorithm
r 1
bi  bi
r
r 1
bi  bi
r


 S i m od 8 B105  8   i / 8   R i  r  ,
0  i  31
 bi  32 ,
32  i  127
r 1


r
r th round
key bit
b i : ith bit of the rth round key, 1≦r≦10, 0≦i≦127
r
b i : ith bit of the 0th round key, copied from the initial key, 0≦i≦127
0
R i  r  : ith bit of a round-dependent word, 0≦i≦31, 1≦r≦10
S x  Bi
r
 : an S-Box function in algebraic normal form (ANF), 0≦x≦7
input: B i =  bi , bi 1 ,
r
9
r
r
, bi  7  , output: one bit
r
2013-7-26
Example of S0(B0)
ANF formula:  b1  b 2    b 2  b3  b 4  
10
+: xor operation
*: and operation
2013-7-26
Example of Bit Representation
b0  b0  S 0  b105 , b106 ,
1
11
0
0
0
, b112   R 0 1 
0
b127  b127  b95
1
0
1
Summary: each bit in the latter 10 rounds is computed
from its former bits → bit-relations
2013-7-26
Outline
 Cold Boot Attack
 Advanced Encryption Standard (AES)
 Recover AES key Schedule
- Using SAT solvers
- Using MaxSAT solvers
- Comparison
 Experiment
 Conclusion
12
2013-7-26
Assumption of AES Key Recovery
 Assumption
- Perfect assumption
 Decay occurs only on 1s
 No reverse flipping errors: no 0s flip to 1
- Realistic assumption
 Decay occurs mainly on 1s
 A few reverse flipping errors: 0.1% of 0s flip to 1
 This work
- Recover AES-128 key schedule based on the
realistic assumption
13
2013-7-26
Recover AES keys using SAT solvers
1. All 1s in the key schedule are
treated as hard constraints
b2  1, b4  1, b6  1,
0
0
0
b127  1,
1
2. All bit-relations are treated as hard
constraints
b 0  b 0  S 0  B105   R 0  1 
1
.
.
.
Perfect assumption 1
No bit flips from 0 to 1
All 1s in the key schedule are correct
14
1
0
0
b  b  S1  B
1
1
0
1
0
105
  R 1 
1
b127  b127  b95
1
0
1
No. of
formulas:
128*10=
1280
3. CryptoMiniSat: support XOR
operation natively
e.g., understand x1  x 2  x3  1
Kamal et al., Applications of SAT solvers to AES key recovery from decayed key schedule images, 2010.
2013-7-26
Recover AES keys using SAT solvers
1. All 1s in the key schedule are
treated as hard constraints
b2  1, b4  1, b6  1,
0
0
0
b127  1,
1
2. All bit-relations are treated as hard
constraints
b 0  b 0  S 0  B105   R 0  1 
1
Sx(Bi): ANF formula, XORing conjunctions of
variables, e.g.,  b1  b 2    b 2  b3  b 4  
15
x1  b1  b 2， x 2  b 2  b3  b 4，
x1  x 2 
0
b1  b1  S 1  B105   R1  1 
1
.
.
.
0
0
0
b127  b127  b95
1
0
1
3. CryptoMiniSat: support XOR
functions natively
e.g., x1  x 2  x3  1
2013-7-26
Recover AES keys using SAT solvers
1. All 1s in the key schedule are
treated as hard constraints
b2  1, b4  1, b6  1,
0
0
0
b127  1,
1
2. All bit-relations are treated as hard
constraints
input
.
.
.
Perfect assumption
No bit flips from 0 to 1
All 1s in the key schedule are correct
16
CryptoMiniSat
output
SAT + assignment of all bits
2013-7-26
Recover AES keys using SAT solvers
1. All 1s in the key schedule are
treated as hard constraints
b2  1, b4  1, b6  1,
0
0
0
b126  1,
1
incorrect
2. All bit-relations are treated as hard
constraints
input
.
.
.
1
Flip from 0 to 1
Realistic assumption
Some bits flip from 0 to 1
Not all 1s in the key schedule are correct
17
CryptoMiniSat
output
UNSAT
2013-7-26
Recover AES keys using SAT solvers
1. All 1s in the key schedule are
treated as hard constraints
b2  1, b4  1, b6  1,
0
0
0
0
0
0
b126  1,
0
1
2. Hard constraints on bit-relations
CryptoMiniSat
.
.
.
1
Flip from 0 to 1
Realistic assumption
Some bits flip from 0 to 1
Not all 1s in the key schedule are correct
18
No
SAT?
Yes
SAT + assignment of all bits
2013-7-26
Recover AES keys using SAT solvers
 To recover a key schedule with n 1s and k
reverse flipping errors
- In the best case:

 CryptoMiniSat needs to run 
- In the worst case
 CryptoMiniSat needs to run

i
C

1
 n  times
 1 i  k  1


C n times
i
0i k
19
2013-7-26
Recover AES keys using MaxSAT solvers
 Deal with two kinds of constraints
- Hard constraints: must be satisfied
- Soft constraints: may be unsatisfied
 MaxSAT solver
- Try to satisfy all hard constraints and the maximum
number of soft constraints
20
2013-7-26
Recover AES keys using MaxSAT solvers
1. All 1s in the key schedule are
treated as soft constraints
b2  1, b4  1, b6  1,
0
0
0
b126  1,
1
unsatified
2. All bit-relations are treated as hard
constraints
input
.
.
.
1
Flip from 0 to 1
Realistic assumption
Some bits flip from 0 to 1
Not all 1s in the key schedule are correct
21
What is
XOR?
MaxSAT solver
output
Maximum No. of satisfied soft constraints
+ assignment of all bits
2013-7-26
Recover AES keys using MaxSAT solvers
 Convert XOR to clauses
- Direct conversion: B i  B j  B k
 n variables → 2n-1 clauses
(￢Bi ∨ ￢Bj ∨ ￢Bk ) ∧
(￢Bi ∨ Bj ∨ Bk ) ∧
(Bi ∨ ￢Bj ∨ Bk ) ∧
(Bi ∨ Bj ∨ ￢Bk ) ∧
- Cut-up conversion: Cut long formula into shorter ones
B i  B1  B 2 
 B109
 Bi  B1  B 2 
 B109  1
C 1   B i  B1  B 2  B 3  B 4 ，
D1  C 1  C 2  C 3  C 4  C 5，
C 22  B105  B106  B107  B108  B109 ，
D 4  C 16  C 17  C 18  C 19  C 20 ，
C1 
D1 
 C 22 =1
 D 4  C 21  C 22 =1
direct conversion
22
2013-7-26
Comparison
 Recover AES key schedule in the presence of
reverse flipping errors
Treat 1s as
Need to run a solver multiple times
for solving an instance?
Support XOR natively?
SAT solver
Hard constraints
MaxSAT solver
Soft constraints
Yes
No
Yes
No
51,440 clauses and XOR formulas
for representing bit-relations
23
372,240 clauses for
representing bit-relations
2013-7-26
Outline
 Cold Boot Attack
 Advanced Encryption Standard (AES)
 Recover AES key Schedule
- Using SAT solvers
- Using MaxSAT solvers
- Comparison
 Experiment
 Conclusion
24
2013-7-26
Experiment(1/4)
 Solver
- SAT: CryptoMiniSat
- MaxSAT: Pwbo2.0
 Better than Akmaxsat, WMaxSatz, QMaxSAT, QMaxSAT-
g2, WPM1, PM2
 Environment
- Core i5-2540 @ 2.6GHz / 8GB
25
2013-7-26
Experiment (2/4)
Decay
CryptoMiniSat (s) Pwbo2.0 (s)
factor (%)
26
30
45.8
0.943
40
28.467
0.956
50
19.665
1.168
60
26.524
1.560
70
225.379
12.532
72
678.452
26.782
74
1004.161
231.610
76
1116.353
296.415
• Setting (real situation)
– Decay factor (probability of
1→0): 30%-76%
– Probability of flipping 0 to 1: 0.1%
– Number of instances for each
decay factor: 100
Among100 instances, the average of
No. of instances with 0, 1, 2 reverse
flipping errors is 50, 36, 14, respectively
• Result
– MaxSAT is superior to SAT
approach
2013-7-26
Experiment (3/4)
Decay
CryptoMiniSat (s) Pwbo2.0 (s)
factor (%)
27
30
2.045
1.037
40
1.310
1.088
50
1.971
1.345
60
5.026
2.252
70
43.532
14.945
72
47.603
28.354
74
280.825
161.740
76
480.101
384.348
• Setting
– Decay factor (probability of
1→0): 30%-76%
– Number of reverse flipping
errors (0 →1): 1
– Number of instances for each
decay factor: 100
• Result
– The superiority of MaxSAT is
not obvious when the number
of reverse flipping errors is 1
2013-7-26
Experiment (4/4)
Decay
CryptoMiniSat (s) Pwbo2.0 (s)
factor (%)
28
30
198.638
1.464
40
162.249
1.562
50
224.689
2.184
60
329.621
4.676
70
3047.821
47.725
72
4909.565
245.177
74
14715.607
2160.648
• Setting
– Decay factor (probability of
1→0): 30%-74%
– Number of reverse flipping
errors (0 →1): 2
– Number of instances for each
decay factor: 40
• Result
– MaxSAT is far superior to SAT
when the number of reverse
flipping errors is 2
2013-7-26
Outline
 Cold Boot Attack
 Advanced Encryption Standard (AES)
 Recover AES key Schedule
- Using SAT solvers
- Using MaxSAT solvers
- Comparison
 Experiment
 Conclusion
29
2013-7-26
Conclusion
 Recover AES key schedule in the presence of
reverse flipping errors
- SAT solver:
 Treat all 1s as hard constraints
 Run the solver repeatedly until it outputs SAT
 CryptoMiniSat: support XOR natively
- MaxSAT solver:
 Treat all 1s as soft constraints
 Solver needs to run only one time
 Do no support XOR natively
 Superior to the SAT approach
30
2013-7-26
31
2013-7-26